CVE-2024-26687: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26687 affects the Linux kernel's Xen events subsystem, specifically related to race conditions in the event channel handling. The vulnerability was discovered in January 2024 and affects the Linux kernel's interaction with the Xen hypervisor (Kernel Git).

The vulnerability stems from a race condition in the shutdown_pirq and startup_pirq functions, which cannot take the irq_mapping_update_lock due to lock inversion. Both functions are called with irq_desc->lock being held, but the required lock order is irq_mapping_update_lock followed by irq_desc->lock. This creates race conditions where event channel allocation and cleanup operations can interfere with each other, potentially leading to invalid mappings in the evtchn_to_irq system (Kernel Git).

The vulnerability can cause system instability and kernel crashes, particularly during the probing of NVMe devices. When multiple NVMe devices are present, the race condition is more likely to occur during boot because multiple shutdown_pirq and startup_pirq calls may run in parallel (Kernel Git).

The issue requires specific timing conditions and primarily affects systems running under the Xen hypervisor with NVMe devices. The vulnerability can trigger a kernel BUG condition, leading to a system crash (Kernel Git).

The fix involves changing the order of operations to first cleanup the mappings and then close the event channel. This ensures that when an event channel is allocated, its potential previous evtchn_to_irq mappings are guaranteed to be unset. The fix has been implemented in various kernel versions including 5.10.x, 5.15.x, and others (Kernel Git).